CVE-2026-18351: Elementor Forms File Upload RCE Vulnerability

CVE-2026-18351 Overview

CVE-2026-18351 is an arbitrary file upload vulnerability in the Drag and Drop File Upload for Elementor Forms plugin for WordPress. The flaw affects all versions up to and including 1.6.0. Insufficient file type validation in the is_file_type_valid() function allows unauthenticated attackers to bypass the MIME allowlist. The elementor_file_upload function accepts an attacker-controlled type parameter used as regex keys against the allowlist. A crafted extension normalized later by sanitize_file_name() resolves to a PHP extension, enabling remote code execution [CWE-434].

Critical Impact
Unauthenticated attackers can upload executable PHP files to vulnerable WordPress sites and achieve remote code execution.

Affected Products

Drag and Drop File Upload for Elementor Forms plugin for WordPress
All plugin versions up to and including 1.6.0
WordPress installations using Elementor Forms with this plugin

Discovery Timeline

2026-09-10 - CVE-2026-18351 published to the National Vulnerability Database (NVD)
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-18351

Vulnerability Analysis

The vulnerability resides in the plugin's file upload handler exposed through the elementor_file_upload function. The handler relies on is_file_type_valid() to verify uploaded content against a MIME allowlist. The validation logic uses a user-supplied type parameter as regex keys during the lookup. This design allows attackers to steer the check away from PHP-related patterns and pass validation with a crafted file extension.

After validation, WordPress calls sanitize_file_name() on the upload. The sanitization routine normalizes the crafted extension into an executable .php extension on disk. The result is a server-writable PHP file placed inside the WordPress uploads directory, reachable over HTTP without authentication.

Root Cause

The root cause is improper input validation combined with a blacklist bypass. The plugin trusts the client-supplied type value to select regex allowlist entries. The MIME check and the eventual filename sanitization operate on different representations of the extension, breaking the security assumption that a validated file cannot become executable.

Attack Vector

Exploitation is remote, unauthenticated, and requires no user interaction. An attacker submits a form containing a file field, sets the type parameter to bypass MIME regex validation, and supplies a filename crafted so sanitize_file_name() produces a .php suffix. The attacker then requests the uploaded PHP file to execute arbitrary code in the web server context. Refer to the Wordfence Vulnerability Report and WordPress Trac File Upload Code for the vulnerable code path.

Detection Methods for CVE-2026-18351

Indicators of Compromise

New or unexpected .php files in the WordPress wp-content/uploads/ directory tree, particularly under Elementor Forms upload paths.
POST requests to admin-ajax.php or the plugin's upload endpoint that reference the elementor_file_upload action from unauthenticated sources.
Uploaded files with double extensions or unusual extension sequences that resolve to .php after sanitization.
Outbound connections from the web server process shortly after file upload activity, indicating post-exploitation behavior.

Detection Strategies

Inspect web server access logs for POST requests to the plugin's upload handler followed by GET requests to newly created files in the uploads directory.
Monitor filesystem changes in wp-content/uploads/ for PHP files, which should not normally be written there.
Correlate web application firewall (WAF) blocks on file upload payloads with authentication state to identify unauthenticated abuse attempts.

Monitoring Recommendations

Enable file integrity monitoring across WordPress content directories and alert on the creation of executable script files.
Ingest WordPress, PHP-FPM, and web server logs into a centralized analytics platform to correlate upload events with subsequent code execution.
Track process creation from the web server user account to identify web shell activity such as spawned shells, curl, or wget invocations.

How to Mitigate CVE-2026-18351

Immediate Actions Required

Update the Drag and Drop File Upload for Elementor Forms plugin to a version newer than 1.6.0 as soon as the vendor releases a fix.
Audit wp-content/uploads/ for any PHP files and remove unauthorized artifacts after preserving forensic copies.
Rotate WordPress administrator credentials, API keys, and database secrets if compromise is suspected.
Review scheduled tasks, plugin lists, and user accounts for backdoors added following successful exploitation.

Patch Information

The vendor addressed the issue in the repository changeset referenced by the WordPress Trac Changeset 3628051. Administrators should upgrade to the fixed release published on the WordPress plugin directory. Review the WordPress Plugin Version 1.6.0 source to confirm the deployed version predates the fix.

Workarounds

Temporarily deactivate the Drag and Drop File Upload for Elementor Forms plugin until the patched release is installed.
Configure the web server to deny PHP execution inside wp-content/uploads/ using directory-level rules.
Deploy a WAF rule that blocks requests to the plugin's upload endpoint containing suspicious type parameters or crafted filenames.

bash

# Configuration example: block PHP execution in WordPress uploads (Apache)
<Directory "/var/www/html/wp-content/uploads">
    <FilesMatch "\.(php|phtml|phar|php\d)$">
        Require all denied
    </FilesMatch>
</Directory>

# Nginx equivalent
location ~* /wp-content/uploads/.*\.(php|phtml|phar|php\d)$ {
    deny all;
    return 403;
}